AIKIDO-2026-578713

TL;DR

Ember's HTTP/2 server never applies its idle timeout to the socket reads used before a stream exists: checkConnectionPreface blocks on a raw socket.read for the connection preface, and the read loop's readFromSocket blocks the same way once a connection has no open stream. A peer that opens a TCP connection to an Ember listener with HTTP/2 enabled and then sends nothing, or completes the preface and goes silent, holds one of the maxConnections slots indefinitely with no timeout and no log line. Once enough such connections accumulate at the default maxConnections of 1024, the listener stops accepting new connections. The fix wraps both reads in the existing idle timeout and issues a GOAWAY when it expires.